Re: [Qemu-devel] [PATCH v2] qapi: fix memory leak in QmpOutputVisitor

[Markus Armbruster]

Pino Toscano <address@hidden> writes:

> qmp_output_start_struct() and qmp_output_start_list() create a new
> QObject (QDict, QList) and push it to the stack of the QmpOutputVisitor,
> where it is saved as 'value'.  When freeing the iterator in
> qmp_output_free(), these values are never freed properly.
>
> The simple solution is to qobject_decref() them.
>
> Signed-off-by: Pino Toscano <address@hidden>
> ---
>
> Changes in v2:
> - added Signed-off-by
>
>  qapi/qmp-output-visitor.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/qapi/qmp-output-visitor.c b/qapi/qmp-output-visitor.c
> index 9e3b67c..eedf256 100644
> --- a/qapi/qmp-output-visitor.c
> +++ b/qapi/qmp-output-visitor.c
> @@ -220,6 +220,7 @@ static void qmp_output_free(Visitor *v)
>      while (!QSLIST_EMPTY(&qov->stack)) {
>          e = QSLIST_FIRST(&qov->stack);
>          QSLIST_REMOVE_HEAD(&qov->stack, node);
> +        qobject_decref(e->value);
>          g_free(e);
>      }

Hmm.  The patch looks correct, even though it adds a decref very similar
to the one deleted by commit f24582d "qapi: fix double free in
qmp_output_visitor_cleanup()".  I suspect the bug you fix was introduced
by commit 455ba08 "qmp: Don't abuse stack to track qmp-output root".
Eric?

Should this go into -stable?